Hybrid Cloud Security Engineer: AWS & CSPM Lead

Alloy; New York (NY); Hybrid; USD 163,000 - 206,000; Full time

Benefits offered by this job

Unlimited PTO

Stock options

401k with match

Home office stipend

Learning & Development stipend

Job summary

Alloy is seeking a Cloud Security Engineer to own the security of our AWS environment and the tooling that keeps it visible. You will work with the Infrastructure team and influence security across all engineering groups.

The role requires 3+ years in cloud security, hands-on AWS networking, IaC with Terraform, and experience with SIEM/CSPM. We value proactive risk reduction and clear communication of security risks to non‑security engineers.

Qualifications

• 3+ years in cloud security or cloud infra with a security focus, primarily in AWS
• Hands-on AWS networking and security services: VPC design, security groups, NACLs, WAF, GuardDuty, Config, Inspector, KMS, and IAM
• Provisioning infrastructure as code with Terraform and working knowledge of Kubernetes or EKS
• Working experience with a SIEM and a CSPM, including tuning alerts and building detections
• Scripting or programming in Python or TypeScript, with an eye for where the code itself creates risk
• On-call incident response experience, and the ability to explain risk and remediation to engineers who do not work in security

Responsibilities

• Partner with the Infrastructure team to build security into new cloud infrastructure as it is designed, and act as the security point of contact for new builds
• Lead initiatives you scope yourself to reduce cloud infrastructure risk in ways that are repeatable and maintainable
• Build alerts, detections, and dashboards in our CSPM and SIEM, and write the runbooks that make them actionable for the people who get paged
• Own CSPM findings end to end, from triage through remediation, including the Terraform changes that fix the problem at its source
• Drive AWS permissions and network design toward least privilege, and debug both without widening the attack surface in the process
• Join the on‑call rotation, investigate security incidents to root cause, and put controls in place so the same incident does not recur

Skills

Cloud security

AWS

Python/TypeScript

On-call incident response

Vulnerability awareness

Security tooling

Tools

Terraform

Kubernetes / EKS

SIEM

CSPM

WAF/GuardDuty

Job description

Alloy is seeking a Cloud Security Engineer to own the security of our AWS environment and the tooling that keeps it visible. You will work with the Infrastructure team and influence security across all engineering groups.

The role requires 3+ years in cloud security, hands-on AWS networking, IaC with Terraform, and experience with SIEM/CSPM. We value proactive risk reduction and clear communication of security risks to non‑security engineers.